Examkin

Question

Difficulty: MediumSecurity Control Categories and Types

An organization is updating its enterprise risk management framework and classifying its existing defense mechanisms according to CompTIA Security+ control categories. The Chief Information Security Officer (CISO) requests an inventory of all Managerial (Administrative) controls currently implemented across the company. Which of the following defense mechanisms qualify as Managerial controls? (Select TWO.)

  1. Performing annual third-party vendor risk assessments to evaluate supply chain security risksAnswer
  2. Establishing an enterprise-wide Acceptable Use Policy (AUP) approved by executive managementAnswer
  3. C
    Configuring Next-Generation Firewalls (NGFW) to inspect and block malicious ingress traffic
  4. D
    Conducting daily physical perimeter security patrols around the data center facility by hired security guards

Answer

Performing annual third-party vendor risk assessments and establishing an enterprise-wide Acceptable Use Policy (AUP) are both Managerial controls.
Both vendor risk assessments and acceptable use policies focus on governance, administrative oversight, and risk strategy. Under CompTIA Security+, controls designed around management decisions, policies, and risk assessments are categorized as Managerial (Administrative) controls.

Step-by-Step Solution

1
Analyze the definition of Managerial controls under CompTIA Security+.
Managerial (Administrative) controls focus on security governance, risk assessment, policies, oversight, and strategic guidelines.
Control categorization depends on how the control is designed and managed within the organizational governance framework.
2
Evaluate each option against the Managerial category criteria.
Third-party risk assessments evaluate organizational risk (Managerial). Acceptable Use Policies set governance rules (Managerial). Firewalls rely on technological mechanisms (Technical). Security guard patrols rely on operational human workflows (Operational).
Differentiating control categories ensures proper assignment of security responsibility and compliance reporting.

Key Concept

Security Control Categories (Managerial / Administrative Controls)
Estimated Time:1m 15s
Rate this question

Topics

Security Control Categories and Types

More questions from this topic